5.2.4. Sensitivity Labels

💡 First Principle: Data doesn't stay inside Power BI. People export to Excel, PowerPoint, and PDF, and once a file leaves the service, workspace roles and RLS no longer apply. Sensitivity labels classify content and attach protection that travels with exported files, so policy follows the data wherever it goes.

Microsoft Purview Information Protection sensitivity labels (for example, Public, General, Confidential, Highly Confidential) are defined by compliance administrators in Microsoft Purview and enabled for Power BI by a Fabric administrator. Report authors then apply them:

• In Power BI Desktop (Home > Sensitivity) to the .pbix; the label carries to the service on publish.
• In the service from an item's settings or the header's sensitivity button, on reports, dashboards, semantic models, dataflows, and other Fabric items.

Key behaviors:

• Export protection: when data is exported to Excel, PowerPoint, or PDF (and Analyze in Excel), the label and any encryption it defines are applied to the file, so only authorized people can open it.
• Inheritance: labels can be inherited from data sources (for example, a labeled Azure SQL source) and downstream from semantic models to reports and dashboards built on them, and when new items are created from labeled items, according to tenant settings.
• Label policies can make labeling mandatory (users must apply a label before saving or publishing) or set a default label for new content.
• Labels are visible to users in the header and lists, raising awareness of how to handle content.
• Applying labels requires appropriate licensing (Power BI Pro or PPU plus Microsoft Purview Information Protection licensing) and label permissions.

Labels classify and protect exported data and drive awareness and policy; they don't restrict who can see data inside Power BI. Combine them with workspace roles, item permissions, and RLS for in-service access control.

⚠️ Exam Trap: When a requirement says "ensure data exported from the report to Excel remains protected and can be opened only by employees," the answer is a sensitivity label with encryption applied to the report or semantic model, not RLS or export settings alone. When the requirement is "users must see only their region in the report," the answer is RLS, not a label.

Reflection Question: A semantic model is labeled Highly Confidential, and an analyst builds a new report on it. What label should the new report carry, which feature makes that automatic, and why does it matter when someone exports the report to PowerPoint?